CVE-2003-0228 Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing...
HighCVSS 7.5
EPSS 46.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows media player | All versions | No fix listed |
| Microsoft windows media player | = 7.1 | No fix listed |
References
- 20030507 Windows Media Player directory traversal vulnerability mailing-list
- 20030508 why i love xs4all + mediaplayer thingie mailing-list
- 20030507 Windows Media Player directory traversal vulnerability mailing-list
- VU#384932 third-party-advisory us-government-resource
- 7517 exploit patch vdb-entry vendor-advisory
- MS03-017 vendor-advisory
- mediaplayer-skin-code-execution(11953) vdb-entry
- oval:org.mitre.oval:def:321 signature vdb-entry